56559cccc494ced993fedc754637a8be | Triage

Sharing

Copy URL Twitter E-mail

General

Target

56559cccc494ced993fedc754637a8be
Size

436KB
MD5

56559cccc494ced993fedc754637a8be
SHA1

4e6d76afd62223dedfebc7ea4163a5a33e18e7b2
SHA256

32cd9a1166e97ac2274d5eff8effb424185855017089e94548725e74dabf513e
SHA512

88239015f1a79450115ddc8c67a7f371d805365a55e11a54662dc601b2e9e1cb1f0f0fa47acca11a0c9ec9d99aa441a88b180cee57a81894b2998ae81ba10e9d
SSDEEP

3072:9GFZppDfea3KJCzNTV0Zf74av9/e4J9oD2n1hgjb7Yi9KxlT1BTI:QFZppLe0KJCBTV2dexKhblT15I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56559cccc494ced993fedc754637a8be

Files

56559cccc494ced993fedc754637a8be
.exe windows:5 windows x86 arch:x86

240890a13eaae031279b53a7c8064a56

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCombineA
PathAddExtensionA

kernel32

LoadLibraryA
VirtualProtect
CreateFileA
ExitProcess
GetProcAddress
VirtualFree
VirtualAlloc

user32

GetMessageA
GetForegroundWindow
TranslateMessage
DialogBoxParamA

Sections

.text
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 428KB - Virtual size: 432KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ